Hacker News new | ask | show | jobs
by lima 1798 days ago
"containers" are just a combination of multiple kernel features, one of which does precisely that (user namespaces).
1 comments

And were known as vaults on HP-UX 11, back in 2000.
Arguably, the issue with these features isn't their existence, since it's not even that hard to add them to a kernel, relative to the generalized difficulty of adding things to a kernel in general. The problem has been the need for mass awareness and desire for the feature, and that's what's taken multiple decades to emerge. It does no good for a kernel to have a security feature that only a vanishing fraction of developers care about and use.

(And I say "vanishing fraction" relative to the pool of developers as a whole; even if a particular subcommunity uses it extensively that doesn't make it a pervasive request. I can name subcommunities with all sorts of exotic interests that have not penetrated the mainstream yet, like the capabilities-based security community. Someday, when that emerges, we'll all point back to E as a pioneer, but in the meantime, effectively nobody wants it right now.)

Sounds like Jails in FreeBSD. Wikipedia says they were added in 1999.
And Zones on Solaris :) phk was the original author of Jails; he wrote an excellent paper called “Defying the omnipotent root”, which I can highly recommend.
*Confining the omnipotent root
Yes indeed! Brain fart, apologies.
And LPARs on System z :)
Both LPARS and z/VM look more like hypervisors to me. Things like containers and chroot probably don't make much sense in the mainframe world since they already had granular facilities to limit access to networks, data sets, etc.
And VMs on IBM VM/370.
Aren’t lpars quite a lot different in nature than zones and jails though?